About TomYoung

Hi @Adrian_Jensen ,   The PANW NGFW can easily do that.  Here is an excellent video -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMwKCAW.  It also has a bonus video on the relationship between the NAT and security policies.  For the security policy, "pre-NAT IP address and post-NAT everything else."  The reason for that rule is that the security policy is checked before NAT is implemented, but after the NAT lookup of the destination zone is done.  (NAT is performed on egress.)   Thanks,   Tom ... View more

Hi @dmoore-acc360 ,   Great question.  For starters, you can go to the PAN-OS® Administrator’s Guide https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin.  Scrolling down the Table of Contents on the left, you will find Policy.  Under Policy > Policy Types, you will find a table of the different policies and a link to the documentation for each one.   With regard to troubleshooting, sometimes you can Google "palo alto <feature> resource list" and see if you get a hit.  I found this for the security policy -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgACAS.   I found this doc for NAT -> https://knowledgebase.paloaltonetworks.com/servlet/fileField?entityId=ka10g000000D83FAAS&field=Attachment_1__Body__s.  It has example security and NAT policies, which are VERY useful.  Here's another one -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CllzCAC.   There is a free course on Beacon, Firewall 9.1 Essentials, that has excellent online tutorials on security and NAT policies.   This link has videos -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PN7rCAG with a few security and NAT policy topics.  The video for destination NAT has another excellent video on the relationship between NAT and security policies.   I hope this helps.  If do, please mark as solution!  🙂   Thanks,   Tom   Edit:  I forgot this link -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGZCA0.  All NAT configurations require a route (connected or other) in order to work. ... View more

Hi @Arumugasamy ,   You can call support to create a case, and they will fix it.   https://www.paloaltonetworks.com/company/contact-support   Thanks,   Tom ... View more

Hi @VLim ,   What is the service set to in rule 1?   Thanks,   Tom ... View more

Hi @smshafek ,   When you say, "Everything is green" I assume that you mean the Status > Tunnel Info and Status > IKE Info are both green under Network > IPSec Tunnels.  Good!  Here are a couple of critical places to look:   Click on Status > Tunnel Info and verify there are PKT ENCAP and PKT DECAP counters.  If there are no encaps, then the problem is on the local NGFW.  If there are no decaps, then the problem is on the remote NGFW. On the problem NGFW, look at Monitor > Logs > Traffic and verify sessions are being allowed to the proper zone.  There could be a LOT of different reasons why this is failing.  You will have to take it from here. Thanks,   Tom     ... View more

Hi @simsim ,   The technical answer to your question is here -> https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/subscriptions/what-happens-when-licenses-expire.   So, no.  It does not limit the bandwidth of the interfaces.   Thanks,   Tom ... View more

Hi @Andreikin ,   Thank you for the information.  You have confirmed that the traffic with "NO" NAT Applied is not matching the NAT rule (or any NAT rule).  The difference is not zone selection, but NAT rule selection.  The destination zone forwarding decision is based upon the NAT rule, if it matches.  I hear you that the NAT rule is very basic with just real and mapped IP address only.  There is nothing else which would cause the traffic not to match it?   Thanks,   Tom   Edit:  If the answer is not apparent in the GUI, use the CLI command "show session id" followed by the session number of a working and non-working session and compare every line. ... View more

Hi @Andreikin ,   With the information provided, it sounds like the traffic is not matching the NAT rule.  Could you add the "NAT Applied" column under Monitor > Logs > Traffic and let me know what is says for the allowed and denied sessions?   Thanks,   Tom ... View more

Hi @Serpil ,   I had the same problem last year.  I called support to create a case, and they fixed it.   https://www.paloaltonetworks.com/company/contact-support   Thanks,   Tom ... View more

Hi @DevonFan ,   "Sync-to-peer" is intended when the HA secondary has no path to the Internet from the management interface.  I would disable it.  Also, this article reiterates what @BPry said.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClrnCAC   Thanks,   Tom ... View more

Hi @TigeRRR ,   In this case, you want to (1) retrieve the NAT policy from multiple firewalls, (2) filter out the static entries, and (3) build a table of the real and NATed IP addresses.  If you want to automate this process, you will need to program or script something, e.g. Python, Ansible, etc.   Regardless of the tool you use, the API interface is much easier to program that the CLI.  In addition, the data is returned in database format (XML or JSON) so that you do not have to screen scrape and tabulate.   In response to your questions:   You pass XML to the API interface instead of CLI. You login with an API key instead of username/password. The API interface does not allow complex RegEx.  That is done with your automation tool. So, configuring an automation tool and learning the API will have an initial steep learning curve, but once you build that foundation you could perform complex, repetitive tasks with ease.   Sorry that I do not have a quick solution.  It sounded like you may already be using an automation tool.   Thanks,   Tom   ... View more